Skip to content

Commit f283a37

Browse files
timoatimoa
authored
Merge pull request #154 from timoa/develop
Update to Node v18.x + security updates
2 parents 3fc08ce + 63955b2 commit f283a37

File tree

13 files changed

+2175
-1553
lines changed

13 files changed

+2175
-1553
lines changed

‎.github/renovate.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"platformAutomerge": true,
88
"branchPrefix": "fix/deps/",
99
"addLabels": [
10-
"deps",
10+
"dependencies",
1111
"security"
1212
],
1313
"assignees": [

‎.github/workflows/code-review.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111

1212
steps:
1313
- name: Harden GitHub Actions Runner
14-
uses: step-security/harden-runner@cdea734fa57747b9831aa9d6fcb274c5f9669557
14+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
1515
with:
1616
egress-policy: block
1717
allowed-endpoints: >
@@ -23,7 +23,7 @@ jobs:
2323
snyk.io:443
2424
2525
- name: Checkout
26-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
26+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
2727

2828
- name: Run ESLint
2929
uses: reviewdog/action-eslint@d3395027ea2cfc5cf8f460b1ea939b6c86fea656 # tag=v1.17.0
@@ -37,7 +37,7 @@ jobs:
3737

3838
steps:
3939
- name: Harden GitHub Actions Runner
40-
uses: step-security/harden-runner@cdea734fa57747b9831aa9d6fcb274c5f9669557
40+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
4141
with:
4242
egress-policy: block
4343
allowed-endpoints: >
@@ -47,9 +47,9 @@ jobs:
4747
raw.githubusercontent.com:443
4848
4949
- name: Checkout
50-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
50+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
5151

5252
- name: Run hadolint
53-
uses: reviewdog/action-hadolint@55be5d2c4b0b80d439247b128a9ded3747f92a29 # tag=v1.33.0
53+
uses: reviewdog/action-hadolint@141ffd8d2f0b75e6fc7c87341331985448b62aa4 # v1.34.1
5454
env:
5555
REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/codeql-analysis.yml

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,27 +32,28 @@ jobs:
3232

3333
steps:
3434
- name: Harden GitHub Actions Runner
35-
uses: step-security/harden-runner@cdea734fa57747b9831aa9d6fcb274c5f9669557
35+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
3636
with:
3737
egress-policy: block
3838
allowed-endpoints: >
3939
api.github.com:443
4040
github.com:443
41+
objects.githubusercontent.com:443
4142
4243
- name: Checkout repository
43-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
44+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
4445

4546
# Initializes the CodeQL tools for scanning.
4647
- name: Initialize CodeQL
47-
uses: github/codeql-action/init@27ea8f8fe5977c00f5b37e076ab846c5bd783b96 # tag=v2.1.12
48+
uses: github/codeql-action/init@a34ca99b4610d924e04c68db79e503e1f79f9f02 # v2.1.39
4849
# Override language selection by uncommenting this and choosing your languages
4950
# with:
5051
# languages: go, javascript, csharp, python, cpp, java
5152

5253
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5354
# If this step fails, then you should remove it and run the build manually (see below).
5455
- name: Autobuild
55-
uses: github/codeql-action/autobuild@27ea8f8fe5977c00f5b37e076ab846c5bd783b96 # tag=v2.1.12
56+
uses: github/codeql-action/autobuild@a34ca99b4610d924e04c68db79e503e1f79f9f02 # v2.1.39
5657

5758
# ℹ️ Command-line programs to run using the OS shell.
5859
# 📚 https://git.io/JvXDl
@@ -66,4 +67,4 @@ jobs:
6667
# make release
6768

6869
- name: Perform CodeQL Analysis
69-
uses: github/codeql-action/analyze@27ea8f8fe5977c00f5b37e076ab846c5bd783b96 # tag=v2.1.12
70+
uses: github/codeql-action/analyze@a34ca99b4610d924e04c68db79e503e1f79f9f02 # v2.1.39

‎.github/workflows/nodejs.yml

Lines changed: 43 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ jobs:
1111

1212
strategy:
1313
matrix:
14-
node: ['16']
14+
node: ['18']
1515
mongodb: ['5.0']
1616

1717
steps:
1818
- name: Harden GitHub Actions Runner
19-
uses: step-security/harden-runner@cdea734fa57747b9831aa9d6fcb274c5f9669557
19+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
2020
with:
2121
egress-policy: block
2222
allowed-endpoints: >
@@ -29,12 +29,15 @@ jobs:
2929
registry-1.docker.io:443
3030
registry.npmjs.org:443
3131
snyk.io:443
32+
docker.io:443
33+
auth.docker.io:443
34+
production.cloudflare.docker.com:443
3235
3336
- name: Checkout
34-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
37+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
3538

3639
- name: Setup Node.js ${{ matrix.node }}
37-
uses: actions/setup-node@eeb10cff27034e7acf239c5d29f62154018672fd # tag=v3.3.0
40+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
3841
with:
3942
node-version: ${{ matrix.node }}
4043
check-latest: true
@@ -52,7 +55,7 @@ jobs:
5255
run: npm run test:coverage
5356

5457
- name: Save Code Coverage
55-
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0
58+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
5659
with:
5760
name: code-coverage
5861
path: coverage
@@ -65,20 +68,21 @@ jobs:
6568

6669
steps:
6770
- name: Harden GitHub Actions Runner
68-
uses: step-security/harden-runner@cdea734fa57747b9831aa9d6fcb274c5f9669557
71+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
6972
with:
7073
egress-policy: block
7174
allowed-endpoints: >
7275
api.github.com:443
7376
github.com:443
7477
pipelines.actions.githubusercontent.com:443
7578
sonarcloud.io:443
79+
scanner.sonarcloud.io:443
7680
7781
- name: Checkout
78-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
82+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
7983

8084
- name: Download Code Coverage
81-
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v3.0.0
85+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
8286
with:
8387
name: code-coverage
8488
path: coverage
@@ -102,19 +106,25 @@ jobs:
102106

103107
steps:
104108
- name: Harden GitHub Actions Runner
105-
uses: step-security/harden-runner@cdea734fa57747b9831aa9d6fcb274c5f9669557
109+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
106110
with:
107111
egress-policy: block
108112
allowed-endpoints: >
109113
github.com:443
110114
api.github.com:443
111115
pipelines.actions.githubusercontent.com:443
112116
registry.npmjs.org:443
117+
registry-1.docker.io:443
118+
osv-vulnerabilities.storage.googleapis.com:443
119+
nvd.nist.gov:443
113120
pypi.org:443
114-
121+
location.services.mozilla.com:443
122+
docker.io:443
123+
auth.docker.io:443
124+
production.cloudflare.docker.com:443
115125
116126
- name: Checkout
117-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
127+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
118128

119129
- name: Perform Scan
120130
uses: ShiftLeftSecurity/scan-action@master
@@ -124,7 +134,7 @@ jobs:
124134
SCAN_ANNOTATE_PR: true
125135

126136
- name: Save the SCAN reports
127-
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0
137+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
128138
with:
129139
name: sast-reports
130140
path: reports
@@ -139,21 +149,24 @@ jobs:
139149

140150
strategy:
141151
matrix:
142-
node: ['16']
152+
node: ['18']
143153
mongodb: ['5.0']
144154

145155
steps:
146156
- name: Harden GitHub Actions Runner
147-
uses: step-security/harden-runner@dd5681a7d0c66fb362664d618ef4a90d656f6516
157+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
148158
with:
149159
egress-policy: block
150160
allowed-endpoints: >
151161
api.github.com:443
152162
auth.docker.io:443
153163
bit.ly:443
164+
cfu.zaproxy.org:443
154165
content-signature-2.cdn.mozilla.net:443
166+
docker.io:443
155167
firefox.settings.services.mozilla.com:443
156168
github.com:443
169+
location.services.mozilla.com:443
157170
news.zaproxy.org:443
158171
objects.githubusercontent.com:443
159172
pipelines.actions.githubusercontent.com:443
@@ -167,10 +180,10 @@ jobs:
167180
tracking-protection.cdn.mozilla.net:443
168181
169182
- name: Checkout
170-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
183+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
171184

172185
- name: Setup Node.js ${{ matrix.node }}
173-
uses: actions/setup-node@17f8bd926464a1afa4c6a11669539e9c1ba77048 # tag=v3.2.0
186+
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
174187
with:
175188
node-version: ${{ matrix.node }}
176189
check-latest: true
@@ -187,10 +200,11 @@ jobs:
187200
- name: Start the app
188201
run: npm start > /dev/null &
189202

190-
- name: Run ZAP Scan
191-
uses: zaproxy/action-full-scan@v0.4.0
203+
- name: Run ZAP API Scan
204+
uses: zaproxy/action-api-scan@6c29b04d78969bf586f2d4ea15c613d2dfb49d07 # tag=v0.2.0
192205
with:
193-
target: http://localhost:3000
206+
target: http://localhost:3000/swagger/json
207+
format: openapi
194208

195209
# -- PRE-RELEASE ------------------------------------------------------------
196210
pre-release:
@@ -204,15 +218,15 @@ jobs:
204218

205219
steps:
206220
- name: Harden GitHub Actions Runner
207-
uses: step-security/harden-runner@cdea734fa57747b9831aa9d6fcb274c5f9669557
221+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
208222
with:
209223
egress-policy: audit
210224

211225
- name: Checkout
212-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
226+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
213227

214228
- name: Semantic Release
215-
uses: cycjimmy/semantic-release-action@v3
229+
uses: cycjimmy/semantic-release-action@8f6ceb9d5aae5578b1dcda6af00008235204e7fa # v3.2.0
216230
env:
217231
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
218232

@@ -225,16 +239,16 @@ jobs:
225239

226240
steps:
227241
- name: Harden GitHub Actions Runner
228-
uses: step-security/harden-runner@cdea734fa57747b9831aa9d6fcb274c5f9669557
242+
uses: step-security/harden-runner@8f144f8401c4e3693085dff03603f617f566ec6b
229243
with:
230244
egress-policy: audit
231245

232246
- name: Checkout
233-
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
247+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
234248

235249
- name: Docker meta
236250
id: meta
237-
uses: docker/metadata-action@69f6fc9d46f2f8bf0d5491e4aabe0bb8c6a4678a # tag=v4.0.1
251+
uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96 # v4.3.0
238252
with:
239253
images: ${{ github.repository }}
240254
tags: |
@@ -248,19 +262,19 @@ jobs:
248262
type=raw,value=latest
249263
250264
- name: Set up QEMU
251-
uses: docker/setup-qemu-action@8b122486cedac8393e77aa9734c3528886e4a1a8 # tag=v2.0.0
265+
uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # tag=v2.1.0
252266

253267
- name: Set up Docker Buildx
254-
uses: docker/setup-buildx-action@dc7b9719a96d48369863986a06765841d7ea23f6 # tag=v2.0.0
268+
uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # tag=v2.2.1
255269

256270
- name: Login to DockerHub
257-
uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b # tag=v2.0.0
271+
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # tag=v2.1.0
258272
with:
259273
username: ${{ secrets.DOCKER_USERNAME }}
260274
password: ${{ secrets.DOCKER_PASSWORD }}
261275

262276
- name: Build and push
263-
uses: docker/build-push-action@e551b19e49efd4e98792db7592c17c09b89db8d8 # tag=v3.0.0
277+
uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3.3.1
264278
with:
265279
context: .
266280
push: true

‎.nvmrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
16
1+
18

‎Dockerfile

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
1-
FROM node:16.15.1-alpine3.15@sha256:1fafca8cf41faf035192f5df1a5387656898bec6ac2f92f011d051ac2344f5c9
1+
FROM node:18.14.0-alpine3.17@sha256:bc329c7332cffc30c2d4801e38df03cbfa8dcbae2a7a52a449db104794f168a3
22
ARG appPort=3000
3-
# ARG microScannerToken
43

54
LABEL maintainer="Damien Laureaux <d.laureaux@timoa.com>" \
65
org.label-schema.vendor="Timoa" \
@@ -20,17 +19,6 @@ RUN \
2019
mkdir -p /opt/app && \
2120
adduser -S app-user
2221

23-
# Aquasec MicroScanner support
24-
# Search vulnerabilities under the source container
25-
# Get an API token (free): https://microscanner.aquasec.com/signup
26-
# Project: https://github.com/aquasecurity/microscanner
27-
28-
# ADD https://get.aquasec.com/microscanner /
29-
# RUN chmod +x /microscanner && \
30-
# /microscanner ${microScannerToken} && \
31-
# echo "No vulnerabilities! " && \
32-
# date
33-
3422
WORKDIR /opt/app/
3523
COPY ./package.json ./
3624
COPY ./src ./src

‎docker-compose.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ version: '3.3'
22

33
services:
44
api:
5-
image: timoa/nodejs-encryption-api-example:latest@sha256:f73079c8045d361899b8c372566616cba1249e61edcc6288549a2f3729dd3de6
5+
image: timoa/nodejs-encryption-api-example:latest@sha256:33cac806d192b0c025adb464d0dae158785b13ade8826a34ca4d08a8f6a19b61
66
environment:
77
- NODE_ENV=production
88
- NODE_HOST=0.0.0.0
@@ -17,7 +17,7 @@ services:
1717
- mongo
1818
mongo:
1919
container_name: mongo
20-
image: mongo@sha256:37e84d3dd30cdfb5472ec42b8a6b4dc6ca7cacd91ebcfa0410a54528bbc5fa6d
20+
image: mongo@sha256:134e3f2db743d46bdb7f3eb6bcfa4b8e3dde578c9ff8a10742ce29d706acf9b2
2121
volumes:
2222
- ./data:/data/db
2323
ports:

0 commit comments

Comments
 (0)